visionclaw@0.1.214
A personal assistant agent that runs on your desktop, receives commands from messaging channels, and executes tasks autonomously.
AI Security Review
scanned 17d ago · by lpm-firewall-aiThe heartbeat command path can trigger uploads of logs, transcripts, and workspace data without local confirmation. Because the destination is package-aligned and the action requires a server-delivered command, the source supports a warning for unresolved authorization rather than a block.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
The agent receives a pending collect_data command in a heartbeat response.
Impact
The service can cause potentially sensitive agent records and workspace files to leave the device without a per-collection confirmation.
Mechanism
The registered handler archives local data and uploads it to the visionclaw-data-collector TOS bucket using credentials available through onboarding.
AI rationale
The heartbeat command path can trigger uploads of logs, transcripts, and workspace data without local confirmation. Because the destination is package-aligned and the action requires a server-delivered command, the source supports a warning for unresolved authorization rather than a block.
Evidence
dist/agent/heartbeat-manager.jsdist/agent/data-collector.js
Decision evidence
public snapshotAI called this Suspicious at 83.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- Heartbeat responses dispatch pending server commands, and the agent registers a `collect_data` handler.
- That handler archives and uploads logs, transcripts, and workspace files to the configured TOS bucket using onboarding-provided credentials; no local confirmation appears in the handler path.
- The package postinstall copies its bundled OpenClaw shim into its own node_modules directory.
Evidence against
- The tunnel callbacks report child-process exit details, and restart code re-executes the current agent; these inspected runtime operations do not establish an attack.
- The data collection destination is a package-named TOS bucket, and collection requires a server-delivered command.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
13 flaggedpackage.jsonView file
•scripts.postinstall = node scripts/setup-openclaw-shim.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgdist-agent/playwriter-relay.cjsView file
•matchType = previous_version_dangerous_delta
matchedPackage = visionclaw@0.1.213
matchedIdentity = npm:dmlzaW9uY2xhdw:0.1.213
similarity = 0.667
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist-agent/playwriter-relay.cjsView on unpkg6var import_node_fs = require("node:fs");
L7: var import_node_child_process = require("node:child_process");
L8: var import_node_module = require("node:module");
Findings
1 Critical7 High7 Medium5 Low
CriticalPrevious Version Dangerous Deltadist-agent/playwriter-relay.cjs
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist-agent/playwriter-relay.cjs
HighShelldist/tools/upgrade.js
HighSame File Env Network Executiondist/tools/android-executor.js
HighSandbox Evasion Gated Capabilitydist/obs/tunnel.js#virtual:normalized:round1
HighRuntime Package Installdist/data-processing/batch-process.js
HighSemantic Analysis Limiteddist/agent/data-collector.js#virtual:normalized:round1
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/agent/data-collector.js
Affected versions and remediation
This report applies to visionclaw@0.1.214.
See all versions of visionclaw for other recorded verdicts.
- Review the evidence and your use of visionclaw@0.1.214 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.